xacml — archive

Re: [xacml] Quality of Service (aka Parameterized Decisions) UseBlurb

From: Erik Rissanen <[email protected]>
To: [email protected]
Date: Thu, 03 Feb 2005 07:08:00 -0000

 MHonArc v2.5.0b2 -->

xacml message

[Date Prev]
 | [Thread Prev]
 | [Thread Next]
 | [Date Next]

--

[Date Index]
 | [Thread Index]
 | [List Home]

Subject: Re: [xacml] Quality of Service (aka Parameterized Decisions) UseBlurb

From: Erik Rissanen <[email protected]>
To: xacml <[email protected]>
Date: Thu, 03 Feb 2005 08:08:16 +0100

Bill Parducci wrote:

> The reason that there is a many-to-one ratio of requestedResources to
> physicalResources is that it is impractical to require the PEP to query
> all possible resourceInstances for access. additionally, the Subject 
> may have access to both systems but the *preferred*/priority is given 
> to the "better" system unless it unavailable (which introduces another 
> concept "fall back decisions", but that is a note on a different day 
> since it would only make sense IF parameterized decisions were 
> possible ;o)

This is similar to a requirement we have been discussing in our work 
with network based defense. I some cases we would like to differentiate 
between regular permissions and "emergency" permission, so that the use 
of the latter would be logged in a special manner and audited more 
thoroughly than other accesses. The logging requirement can easily be 
expressed in an obligation, but if there is both a regular permission 
and an emergency permission for the same access, we would like the 
regular permission to take over so that no special auditing will be done.

Erik

Follow-Ups:

Re: [xacml] Quality of Service (aka Parameterized Decisions) UseBlurb
From: Bill Parducci <[email protected]>

References:

Quality of Service (aka Parameterized Decisions) Use Blurb
From: Bill Parducci <[email protected]>

[Date Prev]
 | [Thread Prev]
 | [Thread Next]
 | [Date Next]

--

[Date Index]
 | [Thread Index]
 | [List Home]